Executive brief
Devtron is a Kubernetes dashboard and CI/CD orchestration platform. A flaw in the webhook API token endpoint allows any authenticated user to retrieve super-admin JWT tokens without proper permission checks, granting full control over the platform. An attacker with basic user credentials can query the vulnerable endpoint with crafted parameters to extract tokens that provide unrestricted administrative access.
Technical details
The vulnerability is an authorization bypass in the GET /orchestrator/api-token/webhook endpoint caused by missing or inadequate authorization checks. Authenticated users (no elevated privileges required) can send HTTP GET requests with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens. The root cause is insufficient role/permission validation before returning sensitive API credentials. An attacker only needs valid authentication; once obtained, the admin tokens grant complete platform control including cluster management, application deployments, and data access. Patches are available in versions after 2.2.0.
Affected products
- Devtron Labs Devtron through 2.2.0
Timeline
- 2026-08-31: disclosed